What does the node write?

A FILE and a FOLDER listing the hosted zones, which is the authoritative set of domains the AWS account controls.

Does it enumerate subdomains?

No. It lists hosted zones only. Pair with subfinder or a similar tool for names under each zone.

When should I prefer cloudlist?

When you need assets across several cloud providers. Prefer aws-route53-zones for a focused Route53 account read.

Is this external recon?

No. It reads an account you already have credentials for. Use it for authorized internal mapping, not third-party probing.

Updated Jul 15, 2026

Utilities

Inventory the domains an AWS account owns

Authenticated Route53 hosted-zone inventory.

Seed recon from the authoritative domain list Inventory an organization's cloud DNS Feed subdomain enumeration at scale

overview

What aws-route53-zones does

aws-route53-zones sits at the start of cloud DNS recon: aws-credentials in, hosted-zone list out as FILE and FOLDER, then subdomain or resolver nodes.

Run it when you have authorized AWS access and need the domains Route53 manages, including private or staging zones that public certificate transparency never lists.

Unlike subfinder, it does not enumerate names under a domain. It reads the account zone set and hands those apex domains to the next discovery step.

use cases

Where aws-route53-zones fits

Seed recon from the authoritative domain list

Pull every Route53 hosted zone to start an attack-surface workflow from the domains the account actually owns instead of a guessed list.

Inventory an organization's cloud DNS

Extract all zones to build a current inventory of managed domains for an asset register or a scoping document.

Feed subdomain enumeration at scale

Hand the zone list to subfinder or assetfinder so discovery runs across the full set of owned domains in one pass.

Catch forgotten or stale zones

List the zones still configured in Route53 to spot domains that are no longer in active use but remain resolvable and exposed.

reference

aws-route53-zones inputs and flags

1 inputs

Name	Type	Flag	Description
aws-credentials	FILE	·	AWS credentials contaning a User with privileges to list AWS Route53 hosted zones.

Showing key inputs. aws-route53-zones exposes 1 inputs in total.

example

Run aws-route53-zones

aws-route53-zones · command

# aws-route53-zones: list hosted zones in the configured accountaws-route53-zones

sample output

example.com. ZAAAAAAAAAAAAA publicapi.example.com. ZBBBBBBBBBBBBB publicinternal.example.com. ZCCCCCCCCCCCCC privatestaging.example.com. ZDDDDDDDDDDDDD publicdev.example.com. ZEEEEEEEEEEEEE public

guidance

Choosing aws-route53-zones

Use aws-route53-zones when you have authorized AWS access and need the real domains the account owns. It reads Route53 config; it does not enumerate subdomains. Feed zones into subfinder or a resolver next.

cloudlist

Multi-provider cloud asset listing, including DNS. Broader than this Route53-only read.

cloud-enum

Unauthenticated hunt for exposed cloud resources. Different angle from an account zone inventory.

subfinder

Passive subdomain discovery. Run after zones are listed to expand each domain.

faq

aws-route53-zones questions

AWS credentials for a user that can list Route53 hosted zones. With those, it returns every zone the account manages.

Run aws-route53-zones yourself

AWS credentials feed aws-route53-zones, which lists the account's hosted zones and passes them to subfinder, writing the discovered subdomains as output.

Run aws-route53-zones in Trickest Browse the library

Facts on this page come from the live Trickest tool library.